UAE Data Protection
Last updated: March 2026
Key position
AILitKit is designed exclusively for teachers (adults). No student data is collected, stored, or processed. The platform helps teachers integrate AI literacy into their teaching, supporting the UAE Ministry of Education's AI literacy mandates effective from the 2025-26 academic year.
UAE PDPL compliance
AILitKit complies with UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data (PDPL):
- Lawful basis (Article 5): Personal data is processed on the basis of consent (account creation) and legitimate interest (guide generation for professional development).
- Purpose limitation (Article 4): Data is collected and processed solely for the purpose of generating AI literacy guides for teachers. No data is used for marketing, advertising, or secondary purposes.
- Data minimisation (Article 5): We collect only the minimum data required: teacher email, optional display name and school, and teaching preferences. No student data is collected or required.
- Data accuracy (Article 5): Teachers can update their personal data at any time from account settings.
- Storage limitation (Article 5): Uploaded files are automatically deleted after guide generation. Account data is retained only while the account is active. Full deletion within 30 days of account closure.
Cross-border data transfers
AILitKit uses service providers located outside the UAE. All cross-border transfers comply with PDPL Article 22:
| Service | Location | Purpose | Safeguards |
|---|---|---|---|
| Google Gemini & Meta Llama Guard 4 12B via OpenRouter | US | AI guide generation and layered pre-generation safeguarding classifier | Zero data retention enforced (account “Always enforce ZDR” policy; non-retaining providers only) |
| Scaleway | EU (France) | Embedding models | Processing only. No data stored |
| Supabase | EU | Database & auth | Contractual protections, encryption at rest |
| Stripe | US | Payments | PCI DSS compliant, contractual protections |
| Resend | US | Delivery logs only | |
| Vercel | US/EU | Hosting | Anonymised request logs |
| Upstash QStash | EU (Frankfurt) | Task scheduling | Processing only. Payloads discarded after delivery |
All processors have contractual agreements ensuring data protection standards equivalent to PDPL requirements. The zero-retention policy on AI processing means no teacher content is stored outside the primary database.
Supervisory authority
The UAE Data Office is the supervisory authority for personal data protection under the PDPL. If you have concerns about how AILitKit handles your data, you may contact the UAE Data Office or reach us directly.
Your rights under PDPL
- Right of access: You can request a copy of your personal data. Use the Export Data button in your account settings.
- Right to rectification: You can update your personal data at any time from account settings.
- Right to erasure: You can delete your account and all associated data. Full deletion within 30 days.
- Right to restrict processing: Contact us to restrict processing of your data.
- Right to object: You may object to processing based on legitimate interest.
MoE and KHDA alignment
AILitKit supports UAE schools in meeting the Ministry of Education's AI literacy mandates and KHDA's AI Literacy Framework for Dubai private schools. The platform generates guides mapped to UAE-specific frameworks, helping teachers embed AI literacy into their existing subject teaching. See our Safeguarding & Responsible Use page for details on framework alignment.
Data Protection Assessment
If your school requires a Data Protection Assessment under PDPL Article 22, a pre-filled assessment template is available from your account settings under Data Protection.
Contact
For data protection enquiries, contact hello@ailitkit.com.